Overview of Database Cluster SSL Configuration for Group Replication
A clustered database environment contains different nodes, constituting one primary node and one or more secondary nodes. There can be only one primary node at any instant. Each node has its own distinct hostname with a MySQL database instance, which is maintained by a separate configuration for that particular node. All the nodes in the cluster collectively represent the database.
There is a Router as well, which is the first point of contact for any client trying to connect to the database.
When enabling SSL connectivity, all of the database nodes and the Router will need to have their own authorization keys and server certificates. These certificates must be authorized by a common Certificate Authority (CA).
The certificates that are commonly used for this setup are:
-
ca.pem: The certificate of the common CA (Certification Authority) -
server-cert.pem: The certificate that is certified by the CA for identifying the database node -
server-key.pem: The private key of the individual database node -
router-cert.pem: The certificate that is certified by the CA for identifying the router -
router-key.pem: The private key of the router
Configuration for the Router and database nodes is described in the following tables. For the purpose of this explanation, the following example shows one router and three database nodes.
Table 1 Router and Database Node Configuration
| Router | - |
|---|---|
| Hostname | mysqlrouter.company.com |
| Config Filename | mysqlrouter.conf |
| Port | 6446 |
| Common Name | mysqlrouter.company.com |
| Certificate Name | server-cert.pem |
| Key file name | server-key.pem |
| Database Node 1 | - |
| Hostname | dbnode1.company.com |
| Config Filename | my.cnf |
| Port | 3308 |
| Common Name | dbnode1 |
| Certificate Name | server-cert.pem |
| Key file name | server-key.pem |
| Node Rank | Primary |
| Database Node2 | - |
| Hostname | dbnode2.company.com |
| Config Filename | my.cnf |
| Port | 3308 |
| Common Name | dbnode2 |
| Certificate Name | server-cert.pem |
| Key file name | server-key.pem |
| Node Rank | Secondary |
| Database Node3 | - |
| Hostname | dbnode3.company.com |
| Config Filename | my.cnf |
| Port | 3308 |
| Common Name | dbnode3 |
| Certificate Name | server-cert.pem |
| Key file name | server-key.pem |
| Node Rank | Secondary |